Unknown vulnerability in CPAINT Ajax Toolkit before 1.3-SP allows attackers to execute arbitrary PHP or ASP code or read files via unknown vectors.
https://exchange.xforce.ibmcloud.com/vulnerabilities/21846
http://www.securityfocus.com/bid/14565
http://www.securityfocus.com/archive/1/408130